Question 37

Explanation

Correct option:

Use AWS Budgets to define spending thresholds for each developer’s account. Configure budget alerts to notify developers when actual or forecasted usage exceeds the set limit. Attach Budgets actions to automatically apply a restrictive DenyAll IAM policy to the developer’s primary IAM role when the budget threshold is crossed

This solution is optimal because it combines cost visibility, real-time notifications, and automated enforcement in a single, low-maintenance workflow. AWS Budgets allows administrators to define both actual and forecasted budget thresholds at the account level and set up alerts that are automatically triggered when spending exceeds defined limits. By attaching Budgets actions, administrators can enforce access control dynamically — for example, by attaching a DenyAll IAM policy to a user or role when their budget is breached. This ensures that developers cannot launch new costly resources beyond their allocation, providing a proactive and automated way to control costs. Since the setup is centralized and integrated with AWS Organizations and Control Tower, it minimizes operational overhead while maintaining governance.

This option combines budget tracking, notification, and enforcement using native AWS Budgets capabilities. With Budgets actions, administrators can define automated responses (e.g., applying a DenyAll policy) when a user’s spend exceeds the defined budget. This solution is fully serverless, scalable, and low maintenance — ideal for controlling developer costs without requiring daily manual intervention.

Incorrect options:

Deploy an AWS Lambda function to run daily in each developer’s account. Use the function to analyze cost usage reports via the Cost Explorer API. If costs exceed a predefined threshold, the function invokes an AWS Config remediation rule - This approach is operationally intensive and not scalable. It relies on building and maintaining custom Lambda logic in each account and introduces complexity with parsing cost data via API. AWS Budgets provides a better way to control cost thresholds and actions using native automation.

Use AWS Service Catalog to restrict developers to predefined resource templates with pricing limits. In each developer account, create a scheduled Lambda function that stops all running resources at the end of the day and and restart these resources at the start of next business day - Although Service Catalog can enforce standardized deployments, it doesn't prevent developers from incurring costs outside the template constraints. Scheduled resource stoppage helps reduce idle costs but does not prevent overspending due to resource scaling or intensive workloads. Also, maintaining separate Lambda functions per account adds operational complexity.

Use AWS Cost Explorer to enable detailed usage and cost reports for each developer account. Configure daily usage reports to be emailed to developers. Create dashboards for each developer in Cost Explorer, and require them to monitor their resource consumption and take action if they approach spending thresholds - While AWS Cost Explorer is useful for visualizing and analyzing cost data, it is a passive monitoring tool — it does not provide enforcement capabilities. There is no built-in way to automatically restrict or deny actions when budgets are exceeded. Requiring developers to monitor their own spending is also not scalable and introduces high operational risk. This approach violates the requirement for automated budget enforcement with minimal overhead.

References:

https://aws.amazon.com/blogs/aws-cloud-financial-management/get-started-with-aws-budgets-actions/

https://docs.aws.amazon.com/cost-management/latest/userguide/ce-what-is.html